Posts on: Injection

---

NoSQL injection occurs when user-controlled input is interpreted as part of a NoSQL query — as an operator, a JSON structure, or a JavaScript expression — rather than as a literal value. It is classified as CWE-943 (Improper Neutralization of Special Elements in Data Query Logic) and sits under OWASP Top 10 A05:2025 (Injection). 2025–2026 context: the class is no longer just {"$ne": null} in a login form. The current CVE feed is dominated by ORM-layer flaws (Mongoose $where nesting, CVE-2025-23061), unauthenticated multi-database operator injection (Budibase, CVE-2026-54350), Redis command injection via SSRF/Gopher, and Cassandra UDF RCE on legacy deployments. The common thread: the application has a schema or an ODM, and the library coerces a type or falls back to a code path the developer did not anticipate.

XML Path Language (XPath) is a query language for selecting nodes from XML documents, used by applications that store or retrieve data in XML — user stores, configuration files, SOAP/SAML backends, and legacy XML databases. When user input is concatenated into an XPath expression without sanitisation, an attacker can rewrite the query’s logic. Because XPath has no privilege model, a successful injection typically exposes the entire document rather than a single row — there is no table-level or column-level access control to stop it.

Lightweight Directory Access Protocol (LDAP) is a protocol used to access directory servers such as Active Directory (AD) via queries to retrieve information. Web applications may use LDAP for integration with AD or other directory services for authentication or data retrieval purposes. 2025–2026 context: LDAP injection remains a CWE-90 issue with a steady stream of CVEs because the same mistake repeats: user input concatenated into a search filter without RFC 4515 escaping. What has changed is the exploitation depth — blind extraction now uses binary search and OID-based bitwise ordering rather than character-by-character wildcard guessing, and WAF bypass relies on RFC-compliant hex escaping and OID aliasing rather than encoding tricks.